Results for “fr”

Scans a codebase for security, database, deployment, code quality, AI/LLM, dependency, frontend, and observability issues before deployment. Intercepts deploy commands and blocks until critical items pass.

Extract embedded configuration from Agent Tesla RAT samples including SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints using .NET decompilation and memory analysis.

Triage web application vulnerability findings from DAST/SAST scanners using OWASP risk rating methodology to separate true positives from false positives and prioritize remediation.

Bypasses SSL/TLS certificate pinning in Android and iOS apps to intercept HTTPS traffic during authorized security assessments using Frida, Objection, and custom scripts.

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials.

Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory, network connections, processes, and system state before they are lost.

Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level, covering the complete stack from database to UI.

Provides a structured methodology for authorized Android and iOS reverse engineering, covering static analysis, dynamic instrumentation with Frida and Objection, SSL pinning bypass, root/jailbreak detection evasion, and cryptographic key extraction.

Audit ad-to-landing-page message match, conversion elements, and UX friction

Systematic Obsidian vault audit and normalization — structure, frontmatter, wikilinks, broken links, Git hygiene.

Automate red team operations using the Covenant C2 framework's REST API for authorized adversary simulation, including listener setup, grunt deployment, task execution, and lateral movement tracking.

Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.

Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.

Intercepts and analyzes HTTP/HTTPS traffic from mobile applications using Burp Suite proxy to identify insecure API communications, authentication flaws, data leakage, and server-side vulnerabilities.

Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.

Use when the user wants to extract reusable offensive security knowledge from any source and generate a SKILL.md file. Trigger on: "distill this", "extract skill from", "turn this into a skill", "generate skill from", "convert this report/blog/book/walkthrough into a skill", or when the user pastes raw security content (bug report, pentest report, CTF writeup, blog post, ezine, book chapter) and wants it transformed into structured hunting methodology.

This skill should be used when the user asks to "reflect on skills from memory", "audit marketplace skills against memory", "从记忆中检查 skills 的问题", "反思并修改 skill", "apply memory feedback to skills", or wants to turn accumulated memory feedback about this marketplace's skills into concrete skill fixes. Reads the project's persistent memory, re-verifies each known skill problem against current code, then fixes the skill or corrects the stale memory.

Extracts indicators of compromise (IOCs) from malware samples, including file hashes, network indicators, host artifacts, and behavioral patterns for threat intelligence sharing and detection rule creation.

Automates privacy impact assessments including data flow mapping, risk scoring, GDPR/CCPA compliance checks, and remediation planning using the NIST Privacy Framework and ICO DPIA guidance.

Detect command injection attacks against Modbus TCP/RTU protocol in ICS environments by monitoring for unauthorized write operations, anomalous function codes, malformed frames, and deviations from established communication baselines.

Provides a structured CLI workflow for Android APK reverse engineering, covering decompilation with jadx and apktool, smali modification, repackaging, signing, and Frida dynamic hooking, with optional native .so analysis via IDA or radare2.

Performs runtime dynamic analysis of Android applications using Frida, Objection, and ADB to observe behavior, intercept function calls, modify runtime values, and identify vulnerabilities missed by static analysis.

Extract and catalog attack patterns from cyber threat intelligence reports into a structured STIX-based library mapped to MITRE ATT&CK for detection engineering and threat-informed defense.

Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists.

Audits frontend codebases for security vulnerabilities and bad practices, covering XSS, CSRF, DOM issues, CSP, input validation, file uploads, and Node.js/NPM dependencies across web, React, Astro, Twig, Node.js, and Bun.

Detect and exploit Server-Side Template Injection vulnerabilities across multiple template engines including Jinja2, Twig, Freemarker, and Velocity, with payloads for sandbox escape and remote code execution. Includes detection methodology, bypass techniques, and fix patterns.

Evaluates Google Cloud workloads against the Well-Architected Framework security pillar, identifies security requirements, and provides actionable recommendations for IAM, network security, data protection, and operational security.

Perform runtime iOS app security assessments using Objection and Frida to inspect keychain, filesystem, and memory, bypass client-side protections, and evaluate data storage, network, and authentication controls during authorized penetration tests.

Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage.

Analyzes iOS IPA bundles and hooks runtime behavior using Frida to inspect Objective-C or Swift methods, Keychain access, SSL pinning, and URL schemes for CTF challenges. Correlates static evidence with live hook output to reproduce accepted request paths.

Node.js development principles and decision-making. Framework selection, async patterns, security, and architecture. Teaches thinking, not copying.

Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.

Research and profile competitors from their URLs into actionable intelligence.

Spring Boot 3.x - Java framework for production-ready applications with dependency injection, REST APIs, data access, security, and actuator monitoring

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

When the user wants help with pricing decisions, packaging, or monetization strategy. Also use when the user mentions 'pricing,' 'pricing tiers,' 'freemium,' 'free trial,' 'packaging,' 'price increase,' 'value metric,' 'Van Westendorp,' 'willingness to pay,' 'monetization,' 'how much should I charge,' 'my pricing is wrong,' 'pricing page,' 'annual vs monthly,' 'per seat pricing,' 'should I offer a free plan,' 'pricing page teardown,' 'pricing page audit,' 'is my pricing page AI-readable,' or 'can AI read my pricing.' Use this whenever someone is figuring out what to charge, how to structure their plans, or wants to audit a pricing page (for humans and for the AI agents that shortlist tools). For in-app upgrade screens, see paywalls. For offer construction (bonuses, guarantees, value framing, naming) on services/courses/coaching/high-ticket B2B, see offers.